REMARKS 

Claims 11-29 have been canceled. Claims 1-10 and 30-39 are currently pending in the 
present application, of which Claim 1 has been amended. 

The phrase "computer program code for" is inserted to the second and third recited steps 
of Claim 1 to be consistent with the first recited step of Claim 1. No new matter has been added. 

Rejection under 35 U.S.C. S 103 

Claims 1-2, 5-7, 9-10, 30-31, 34-36 and 38-39 were rejected under 35 U.S.C. § 103(a) 
as being unpatentable over Vaidya (US 6,279,113) in view of Hyppdnen et al (US 6,577,920). 
Apphcants respectfully traverse such rejection insofar as it might apply to the claims as amended 
herein. 

Vaidya is related to a method for detecting intrusion attempts by monitoring for attack 
signatures. Although the claimed invention also has a similar element of performing vims 
detection by identifying virus signatures, the claimed steps are different from Vaidya'^ teachings 
because the claimed invention is directed to solving a different problem from that of Vaidya, 

For example, on page 3 of the Final Office Action, the Examiner asserts that the claimed 
computer program code for categorizing is disclosed by Vaidya in the Abstract and col. 3, lines 
12-16. The Examiner characterizes Vaidya'^ network object as the claimed executing agent, and 
seems to farther characterize Vaidya's attack signature profiles as the claimed virus signatures. 
According to Vaidya, "attack signature profiles are organized into sets of attack signature profiles 
which are assigned to network objects based on security requirements of the network objects" 
(col. 3, lines 28-30). In addition, Vaidya's detection is based on data addressed to one of the 
network objects. Basically, "[u]pon detecting data addressed to one of the network objects, a set 
of signature profiles corresponding to that network object is access from the signature profile 
memory based on the associated data" (col. 3, lines 42-44). Furthermore, "[a]t least one attack 
signature profile from the set of profiles is processed to determine if the data address to the 
network object is associated with a network intrusion" (col. 3, line 44-47). 
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In contrast, Claim 30 (and similarly Claim 1) recites a step of "in response to said target 
file being opened by said associated executing agent, scanning contents of said target file for 
viruses by applying virus signatures stored in said subset of said plurality of said anti-virus sets 
associated with said executing agent." In other words, the claimed scanning is triggered by a 
target file being opened by an associated executing agent (and not triggered by an access to a 
network object as taught by Vaidya). In addition, the claimed target file, which is associated with 
an executing agent, is not taught or suggested by Vaidya and Hyppdnen. 

On page 3 of the Final Office Action, the Examiner asserts that the claimed scanning step 
is disclosed by Hyppdnen in col. 3, lines 14-20. In coL 3, lines 14-20, Hyppdnen teaches that 
a first database is defined to contain known macro virus signatures, a second database is defined 
to contain known and certified commercial macro signatures, and a third database is defined to 
contain known and certified local macro signatures. Thus, only the first database of Hyppdnen, 
which is defined to contain known macro virus signatures, seems to be relevant to the claimed 
invention. Since Hyppdnen has only one database that is relevant to the claimed invention, 
Hyppdnen does not teach or suggest " said plurality of said anti- virus sets associated with said 
executing agent" (emphasis added), as claimed. 

Because the cited references, whether separately or combined, do not teach or suggest the 
claimed invention, the § 103 rejection is beUeved to be overcome. 
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CONCLUSION 



Claims 1-10 and 30-39 are currently pending in the present application. For the reasons 
stated above. Applicants believe that independent Claims 1 and 30 along with their respective 
dependent claims are in condition for allowance. The remaining prior art cited by the Examiner 
but not relied upon has been reviewed and is not believed to show or suggest the claimed 
invention. 

No fee or extension of time is believed to be necessary; however, in the event that any 
addition fee or extension of time is required for the prosecution of the present application, please 
charge it against Lenovo Deposit Account No. 50-3533. 
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